Method and system for scripting commands and data for use by a personal security device

ABSTRACT

System and method for optimizing communications using a communications pipe over a network. This invention provides means to locally execute an APDU script and collect APDU responses locally for batch transfer to a remote server.

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] The present application is related to co-pending U.S. patentapplication Ser. No. 09/844,246 entitled, “METHOD AND SYSTEM FORESTABLISHING A REMOTE CONNECTION TO A PERSONAL SECURITY DEVICE,” filedon Apr. 30, 2001, and assigned to the assignee of the present invention.Applicant hereby incorporates by reference the above-mentionedco-pending application, which is not admitted to be prior art withrespect to the present invention by its mention here or in thebackground section that follows.

FIELD OF INVENTION

[0002] The present invention relates to a data processing method andsystem for improving communications through a communications pipeemployed over a network between a Personal Security Device (PSD) and aRemote Computer System.

BACKGROUND OF INVENTION

[0003] The current art involving the management of information and datacontained in a personal security devices (PSD), for example, smartcards, subscriber identity modules (SIM), wireless identificationmodules (WIM), biometric devices, or combinations thereof, requiresdiscrete low-level commands known in that art as application protocoldata units (APDUs) to be sent to a PSD.

[0004] The PSD is a reactive device in which a returned response isgenerated after completion of each command executed or upon encounteringan error in execution. The majority of the responses returned by the PSDare simple “processing complete” or equivalent messages. In a networkedenvironment, awaiting the return of such responses unnecessarily ties upnetwork bandwidth and server resources due to the latency of thetransactions and relatively slow execution speeds of the PSDs.

[0005] A second limitation is due to the relatively low-level nature ofthe PSD operating environment, which typically requires severalsequential APDU commands to be executed in order to accomplish anoperation within a PSD. This could be particularly troublesome when alarge number of PSDs are being managed from a central server.

[0006] Co-pending U.S. patent application Ser. No. 09/844,246, entitled“Method and System for Establishing a Remote Connection to a PSD,” andassigned to the assignee of the present invention, describes acommunication pipe, which allows a remote server to maintaincommunications with one or more PSD's over a network which could besusceptible to the foregoing limitations. As such, a means to minimizethe potential latency effects imposed on a network is highly desirable.

SUMMARY OF INVENTION

[0007] The present invention is directed to a method and system, whichresolves the potential latency problems associated with maintainingcommunications pipes over a network.

[0008] To practice this invention, a stack of APDU commands is generatedand stored in a command script on the remote computer system. Thecommand script is then sent over a network to a client to be executedlocally by a pipe client program. As described in the co-pending U.S.patent application Ser. No. 09/844,246, the pipe client is an API levelprogram which extracts APDUs from incoming message packets andencapsulates APDUs into outgoing message packets.

[0009] Upon receiving the command script, the pipe client temporarilystores the command stack in either a memory location or disk file andsequentially sends the APDU commands to the PSD for processing.Sequencing of the APDU commands is accomplished by receipt of an APDUresponse, which causes the next APDU command to be issued. The APDUresponses are likewise temporarily stored in either a memory location ordisk file for later transmission to the remote computer system. Thisprocess continues until the last APDU command is sent and itscomplementary APDU response is received and stored in a response script.Once completed, the response script is sent to the remote computersystem for processing.

[0010] By recording APDU commands in a script and locally capturing theresulting APDU responses, the handshaking between the PSD and remotecomputer system is significantly reduced thus freeing networking andserver resources.

[0011] In one embodiment of the invention the accumulated responses arestored as generated by the PSD. In a second embodiment of the invention,the APDUs are compressed to optimize storage and transmission throughputbetween the PSD and Remote Computer System. The file compression may beperformed on the fly by using the file compression options included inMicrosoft Windows™ 2000 or NT. An advantage in using the operatingsystem to perform the data compression is the ability to add encryptionto the stored and compressed data, which is transparent to the end user.Additional hardware or software data compression techniques may beemployed during network communications to further reduce the size andnumber of packets exchanged between the remote computer system and thePSD.

BRIEF DESCRIPTION OF DRAWINGS

[0012] A more complete understanding of the present invention may beaccomplished by referring to the following Detailed Description andclaims, when viewed in conjunction with the following drawings:

[0013]FIG. 1—is a system block diagram depicting a version of thepresent invention where APDU commands are accumulated in the form of acommand script (CMD Script);

[0014]FIG. 2—is a system block diagram depicting a version of thepresent invention where the command script is transferred to a clientfor processing;

[0015]FIG. 3—is a system block diagram depicting a version of thepresent invention where command APDUs contained in a command script areprocessed by a pipe client program and sent to a PSD for execution;

[0016]FIG. 4—is a system block diagram depicting a version of thepresent invention where response APDUs are returned from a PSD,processed by a pipe client program and accumulated in a response script(RSP Script);

[0017]FIG. 5—is a system block diagram depicting a version of thepresent invention where the response script containing the accumulatedAPDUs is returned to a remote computer system for processing;

[0018]FIG. 6—is a system block diagram depicting a version of thepresent invention where response APDUs are processed by a pipe serverprogram installed in a remote computer system.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENT

[0019] This invention provides a method and system for improvingcommunications through a communications pipe over a network. In thisinvention, APDU commands are generated and accumulated in the form of acommand script on a remote computer system. Once the command script hasbeen generated, it is then transmitted to a local client for processingand execution by an associated PSD. The resulting APDU responses arelikewise accumulated and stored in a response script, which is thenreturned to the remote computer system following completion of thecommand script or upon detection of an error condition. By consolidatingAPDU commands and responses in scripts, significantly less networktraffic is generated thus optimizing the use of networking resources andsimplifying management of large numbers of PSDs.

[0020] Referring to FIG. 1, a block diagram of a local client 10 and aremote computer system 50 are depicted. Remote computer system 50contains API level programs 100 for generating and interpreting highlevel commands. High-level commands are translated into the low-levelAPDU messaging protocol required by a PSD 40 using a specialized APIlevel program called an APDU Interface 55. The APDU Interface 55 alsoserves to translate incoming APDU messages into higher-level messagesfor use by the API Programs 100.

[0021] A second specialized program contained within the API Level ofthe Remote Computer System 50 and referred to as a Pipe Server 70,interacts with Communications Programs 105 S contained within thecommunications layer. The Pipe Server 70 functions to separateencapsulated APDU Responses 90 from incoming messaging packets receivedfrom a network 45 for processing by the APDU Interface 55.

[0022] Alternately, outbound APDU commands are translated by the APDUInterface 55 and processed by the Pipe Server 70 for accumulation 135 ina Command Script (CMD Script) 125. The Command Script 125 is thenencapsulated into an agreed upon communications protocol by the PipeServer 70 and sent to the Communications Programs 105 S fortransmission. The Command Script 125 may be temporarily stored beforetransmission. Optionally, file compression and cryptographic protectiontechniques may be employed to improve networking performance andtransaction security. The Communications Programs 105 S communicatesthrough the hardware I/O device interface 130 S, which connects the pipe75 to a network 40 for communicating with at least the Client 10.

[0023] The Client 10 likewise communicates using internal CommunicationsPrograms 105 C through its hardware I/O device interface 130 C, whichconnects 75 to the network 40 for communicating with at least the RemoteComputer System 50. A third specialized API level program referred to asa Pipe Client 15, interacts with the Communications Programs 105 C. ThePipe Client 15 functions to separate encapsulated Command Scripts 125from incoming messaging packets received from the network 45. Ifemployed, the Command Scripts 125 are decompressed and/or unencrypted bythe Communications Programs 105 C and cryptographic services programsbefore being processed by the Pipe Client 15. Once the Pipe Client hascompleted processing, the Command Scripts 85 are temporarily stored. Asbefore, optional file compression and cryptographic protectiontechniques may be employed to improve local file storage utilization andtransaction security.

[0024] Alternately, outbound APDU response messages generated by alocally connected PSD 40 are processed by the Pipe Client 15 andtemporarily stored in a Response Script (RSP Script) 90. The responseAPDUs are generated by the PSD 40 following sequential processing ofeach APDU command contained in the Command Script 85. The APDU responsesare communicated through the PSD Hardware Device Interface 25, into theClient 10 via the I/O Device Port 5 and subsequently directed to thePipe Client 15 by a software driver. The APDU responses are accumulatedin the Response Script 90 until the last APDU command is processed andthe final APDU response message received and stored. The completedResponse Script 90 is then encapsulated into an agreed uponcommunications protocol by the Pipe Client 15 and transmitted by theCommunications Programs 105 C through the pipe 75 and over the network45. Again, optional file compression and cryptographic protectiontechniques may be employed to improve networking performance andtransaction security.

[0025] Referring to FIG. 2, the completed Command Script 125 isretrieved 220 and encapsulated into an agreed upon communicationsprotocol by the Pipe Server 70, routed 225 to the CommunicationsPrograms 105 S, incorporated into an outbound Message 230, sent throughthe Pipe 75, across the Network 45, and received by the Client 10. TheCommunications Programs 105 C processes the incoming Message 240 and theresulting Packets 250 are routed to the Pipe Client 15 for processing.The Pipe Client 15 extracts 255 and temporarily stores the CommandScript 85.

[0026] Referring to FIG. 3, the Pipe Client 15 retrieves 360 andsequentially processes the command APDUs contained in the Command Script85. The first APDU command (APDU1) is directed 365 through the I/ODevice Port 5 by the software driver and routed 370 to the PSD Interface25. The PSD Interface 25 directs 30 the APDU command to the PSD 40 andinto the processing domain 35.

[0027] Referring to FIG. 4, the PSD 40 upon completing processing of theAPDU command (APDU1), generates a response APDU (APDU1r) that is sent 30to the PSD Interface 25 where it is routed 470 through the I/O DevicePort and directed 465 to the Pipe Client 15 by the software driver. TheAPDU response message (APDU1r) is then processed by the Pipe Client andtemporarily stored 460 in a Response Script 95. The receipt and storageof the APDU response message (APDU1r) causes the Pipe Client 15 to issuethe next APDU command (APDU2). This process continues until the finalAPDU command (APDU3) is sent to the PSD 40 and an APDU response message(APDU3r) is received and stored in the Response Script 95. Again,optional file compression and cryptographic protection techniques may beemployed to improve networking performance and transaction security.

[0028] Referring to FIG. 5, the completed Response Script 95 isretrieved 560 and processed by the Pipe Client and encapsulated into anagreed upon communications protocol, routed 550 to the CommunicationsPrograms 105 C, incorporated into an outbound Message 540, sent throughthe Pipe 75, across the Network 45, and received by the Remote ComputerSystem 50. The Communications Programs 105 S processes the incomingMessage 530 and the resulting packets 525 are routed 510 to the PipeServer 70 for processing. The Pipe Server 70 extracts 520 andtemporarily stores the Response Script 525.

[0029] Referring to FIG. 6, the Pipe Server 70 retrieves 635 andsequentially processes the APDU response messages, which are sent to theAPDU Interface 55 through the Communications Programs 105 S and the APIPrograms for processing. The processed messages are then sent back tothe API Programs 100 for translation into higher-level messages.

What is claimed:
 1. A system for optimizing communications through at least one communications pipe over at least one network comprising: at least one client further comprising a functionally connected PSD, cryptography means, data processing means, data storage means and communications means, wherein; said at least one client is in processing communications with at least one remote computer system over said at least one network and maintaining said at least one communications pipe between said at least one remote computer system and said PSD; said data storage means including means for storing at least one command script received from said at least one remote computer system, wherein said at least one command script includes one or more properly formatted commands for execution by said PSD; said communications means includes means for sequentially sending said one or more properly formatted commands included in said at least one command script to said PSD; said PSD further comprising cryptography means, data processing means and communications means, wherein said PSD is functionally connected to said at least one client and in processing communications with said at least one remote computer system through said at least one communications pipe over said at least one network; said at least one remote computer system comprising cryptography means, data processing means, data storage means and communications means, wherein; said at least one remote computer system is in processing communications with said at least one client over said at least one network; said at least one remote computer system is in processing communications with said PSD through said at least one communications pipe over said at least one network; said data processing means includes means for generating said at least one command script, wherein said at least one command script includes one or more properly formatted commands for data processing by said PSD; said data storage means includes means for storing said at least one command script; and said communications means includes means for sending said at least one command script to said at least one client over said at least one network.
 2. The system according to claim 1, wherein said PSD data processing means includes means for generating responses to said one or more properly formatted commands included in said at least one command script.
 3. The system according to claim 2, wherein said PSD communications means includes means for sending said responses to said at least one client.
 4. The system according to claim 1, wherein said at least one command script is compressed during transmission.
 5. The system according to claim 1 or 4, wherein said at least one command script is cryptographically protected.
 6. The system according to claim 1, wherein said at least one client said data storage means includes means for storing said responses received from said PSD in at least one response script.
 7. The system according to claim 6, wherein said at least one response script is cryptographically protected.
 8. The system according to claim 6 or 7 wherein said at least one response script is sent to said at least one remote computer system over said at least one network.
 9. The system according to claim 8, wherein said at least one response script is compressed during transmission.
 10. The system according to claim 1, wherein said at least one remote computer system data processing means includes means for analyzing said responses sent by said at least one client.
 11. A method for optimizing communications through at least one communications pipe over at least one network comprising: generating at least one command script on at least one remote computer system, wherein said at least one command script includes one or more properly formatted commands; sending said at least one command script to at least one client, wherein said at least one remote computer system is in processing communications with said at least one client over said at least one network and with a PSD, functionally connected to said client, through said at least one communications pipe over said at least one network; receiving said at least one command script by said at least one client; temporarily storing said at least one command script by said at least one client, sequentially processing said at least one command script by said at least one client, sending said one or more properly formatted commands to said PSD, receiving said one or more properly formatted commands by said PSD, processing said one or more properly formatted commands by said PSD, generating a response to each said one or more properly formatted commands by said PSD, sending each said response to said at least one client, receiving each said response by said at least one client, storing each said response by said at least one client in at least one response script, sending said at least one response script by said at least one client over said at least one network to said at least one remote computer system, storing said at least one response script by said at least one remote computer system and processing said at least one response script by said at least one remote computer system.
 12. The method according to claim 11, wherein said at least one command script is sent compressed.
 13. The method according to claim 11, wherein said at least one command script is sent cryptographically protected.
 14. The method according to claim 11, wherein said at least one response script is sent compressed.
 15. The method according to claim 11, wherein said at least one response script is sent cryptographically protected. 